Patched code sample

import markupsafe

def fixed_comment_serialization(comment_data):
    """
    This function demonstrates the logic that fixes the Stored XSS vulnerability
    (originally identified as CVE-2021-28469) in Isso.

    The vulnerability was caused by improperly escaping the 'website' field
    using a call equivalent to `markupsafe.escape(..., quote=False)`.
    This setting does not escape single or double quotes. Since the frontend
    injected the 'website' URL into a single-quoted href attribute (e.g.,
    <a href='...'>), an attacker could provide a URL containing a single quote
    to break out of the attribute and inject malicious event handlers.

    For example, a malicious URL like:
    https://example.com' onmouseover='alert(\"XSS\")'

    ...would result in the following vulnerable HTML:
    <a href='https://example.com' onmouseover='alert(\"XSS\")'>

    The fix, represented below, is to ensure that all user-provided string fields,
    especially 'website', are escaped using the default, secure behavior of
    `markupsafe.escape()`. The default setting (`quote=True`) correctly converts
    special characters like ' and " into their corresponding HTML entities
    (' and "), neutralizing the XSS payload.

    Args:
        comment_data (dict): A dictionary containing raw comment fields like
                             'text', 'author', and 'website'.

    Returns:
        dict: The comment data with fields properly escaped to prevent XSS.
    """
    sanitized_data = {}

    # The patched code applies strong, default escaping to all relevant fields.
    # This logic was applied in the places where comment data is prepared for
    # JSON responses to the client.
    for field in ["author", "website", "text"]:
        if field in comment_data and comment_data[field]:
            # The fix is to use markupsafe.escape() with its default `quote=True`.
            # This correctly escapes single quotes ('), double quotes ("),
            # ampersands (&), and angle brackets (<, >).
            sanitized_data[field] = markupsafe.escape(comment_data[field])
        else:
            sanitized_data[field] = comment_data.get(field)

    return sanitized_data

# --- Example demonstrating the effect of the fix ---

# Malicious payload designed to break out of a single-quoted HTML attribute.
malicious_payload = {
    "author": "Attacker",
    "website": "https://example.com' onmouseover='alert(\"XSS\")' data-dummy='",
    "text": "<script>alert('XSS')</script>"
}

# Apply the fixed serialization logic to the malicious payload.
safe_data = fixed_comment_serialization(malicious_payload)

# The resulting 'safe_data' dictionary now contains neutralized strings
# that are safe to render in an HTML context.
#
# print(safe_data)
#
# Expected output from the print statement:
# {
#     'author': 'Attacker',
#     'website': 'https://example.com' onmouseover='alert("XSS")' data-dummy='',
#     'text': '<script>alert('XSS')</script>'
# }
#
# As shown in the expected output, the single and double quotes in the 'website'
# field are converted to HTML entities, preventing the browser from interpreting
# them as closing delimiters for the href attribute or as part of a new attribute.